Add support for external systems, ramfs and UUU flashing - #26
Merged
Conversation
sylane
commented
Jul 24, 2026
sylane
commented
Contributor
- Add support external systems/ramfs repositories
- Add support for initramfs build
- Add UUU flashing script
- Add security pack generic generation script
Add a shared resolver for external Alloy bundle roots. Existing in-tree targets remain the default. External targets expose normalized paths, bundle roots, source type, VCS metadata, and toolchain config lookup. Forward the new --external option through the build entrypoints and make toolchain config lookup observable with --print-config. Harden argument parsing so external paths with shell metacharacters are kept as data.
Add a shared Vagrant helper that stages external bundle roots inside the guest under _build/external. Delegated build commands now forward translated guest --external paths instead of host paths. Exclude repository metadata and common build outputs from the sync. Record the implemented staging path in the refactor plan. Leave VM execution for the approved validation phase.
Import the generic ramfs Buildroot flow, ramfs_common, and the public Kontron shell validation flavour. Wire Vagrant so the guest receives the ramfs entrypoint and public ramfs trees. Resolve ramfs flavours through the shared external bundle path contract. External ramfs directories now work with repeated --external flags and GRISP_ALLOY_EXTERNAL_PATH, including duplicate-match rejection.
Add a generic --ramfs option to build-firmware.sh. Resolve required ramfs artifacts from artefacts when a target declares a required ramfs flavour. Pass the resolved path through the boot scheme contract. Update AHAB to use the provided ramfs artifact path instead of an undefined SDK image name.
Import flash-firmware.sh as a target-capability based helper. Targets without uuu.conf fail before SDK install or hardware access. The error clearly reports unsupported flashing. Keep destructive flashing behind the existing confirmation flow. Preserve dry-run support. Forward translated external paths through Vagrant. Private targets can provide their own UUU config.
Import gen-secpack.sh and public secpack.conf files. The generator creates development update-signing material and delegates target-specific secureboot generation to optional target hooks. Forward translated external paths through Vagrant. Private targets can provide their own secpack.conf and secpack.sh. Make argparse safe under set -u for options without defaults.
Let targets declare accepted firmware profiles and provisioning modes. Targets without declarations keep accepting only the default profile and normal provisioning mode. Export selected values for target hooks and record them in the manifest. Forward explicit selections through Vagrant delegation.
Add a target-declared SDK artifact profile mechanism. Profiled targets can capture selected Buildroot image artifacts as artifact.profile. Existing targets keep the unsuffixed image layout. Run profile passes only when declared artifacts are missing. Also run them when requested package cleanup affects profile artifacts. Preserve invariant artifacts and write metadata. Resolve firmware SDK image inputs through the profile-aware helper.
Prefer a boot scheme from the resolved target system. Fall back to the shared plugin directory. Private external targets can provide boot schemes such as HABv4 without adding private code to upstream.
Use an optional .grisp_alloy_exclude file when staging project sources. Projects can omit development-only files from firmware artefacts. Quote project staging commands consistently. Use the target Erlang lib directory for rebar3 system libraries.
Bump erlinit and add --skip-pseudo-filesystems. Initramfs handoff systems can keep existing pseudo-fs mounts. Add an early-init runtime-only mode. It skips /data mounting when initramfs already owns storage setup. Copy optional target fwup upgrade helpers during post-image processing.
Add a Buildroot patch that makes host python-cryptography depend on host-patchelf and sets an explicit rpath to the SDK host lib directory. This avoids relocated SDK Python helpers loading system OpenSSL. They should load the Buildroot host OpenSSL.
Allow secure external targets to require related toolchain and ramfs components from the same external bundle root. Source target declarations before toolchain config lookup and verify declared ramfs flavours during firmware packaging. Targets that do not opt in keep the existing in-tree and external search behavior.
Describe GRISP_ALLOY_EXTERNAL_PATH, repeated --external flags, ramfs builds, security-pack generation, generic flashing, firmware mode selection, and project exclude files in the README. Update the external-bundle planning notes to show completed resolver and private extraction work while keeping build, VM, and hardware validation gates open.
Write hashed resolver context into SDK archives and verify it when downstream commands install or reuse an SDK for external targets. Propagate target and common source hashes into project packages and firmware metadata so firmware packaging and flashing reject stale or cross-bundle external artefacts before secure operations proceed.
Describe split repositories as the source of truth instead of referring to a previous combined development checkout. Keep the workflow focused on current upstream and private bundle repositories and use neutral historical-commit wording for provenance guidance.
Keep build-project SDK validation focused on target identity so external bundle documentation or host-only test cleanup does not invalidate an otherwise usable generated SDK. Require exact source tree provenance only for firmware packaging, security pack generation, and flashing, where stale external inputs can affect signed or deployable artifacts.
ziopio
approved these changes
Jul 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.